Updating a product via the REST API assigns it to all websites automatically.

[andrewkett]

Updating a product via the REST API using PUT /rest/all/V1/products/example_sku assigns it to all websites automatically.

Possibly a duplicate of #10495

Preconditions

1. Magento 2.2.0 CE (upgraded from 2.1.9)
2. PHP 7.0.20
3. MYSQL 5.7.17
4. NGINX

Steps to reproduce

1. Remove a product from all websites in admin
2. GET V1/products/example_sku via REST API to confirm product isn't assigned to any stores
3. update product data at global scope via PUT rest/all/V1/products/example_sku
4. GET V1/products/example_sku via REST API again

Expected result

1. Products should be assigned to same stores as it was previously (none) as I didn't pass website_ids in extension attributes and I didn't call V1/products/example_sku/websites

Actual result

1. Product is assigned to all websites even though I didn't explicitly send any website associations

Example API calls made to replicate this issue.

GET http://mysite.com/index.php/rest/all/V1/products/example_sku

response (truncated)

{
    "id": 971,
    "sku": "example_sku",
    "name": "Example Product",
    "attribute_set_id": 9,
    "price": 0,
    "status": 1,
    "visibility": 4,
    "type_id": "configurable",
    "created_at": "2017-10-07 03:56:47",
    "updated_at": "2017-10-10 03:37:00",
    "weight": 0
    "extension_attributes": {
        "website_ids": []
    },
    ...
}

note that the website_ids array is empty as I have unassociated the product from any websites

PUT http://mysite.com/rest/all/V1/products/example_sku

{
  "product": {
    "name": "Example Product Updated"
 }
}

note that I am not passing any website_ids to associate the product with any stores.

GET http://mysite.com/index.php/rest/all/V1/products/example_sku

response (truncated)

{
    "id": 971,
    "sku": "example_sku",
    "name": "Example Product Updated",
    "attribute_set_id": 9,
    "price": 0,
    "status": 1,
    "visibility": 4,
    "type_id": "configurable",
    "created_at": "2017-10-07 03:56:47",
    "updated_at": "2017-10-10 03:54:48",
    "weight": 0,
    "extension_attributes": {
        "website_ids": [
            1,
            2,
            3
        ]
    }
    ...
}

note that the website_ids array is now populated with all website ids.

I understand that I am using "all" which is setting values for all store views however I think it should still be possible to update attribute values globally without automatically assigning products to websites. e.g We have 9 websites in a single Magento install, some products are used on multiple websites but not all websites. We want to update the product data at global scope so the data can be reused across stores but currently doing this means that the product then becomes available on all websites which could be very bad if this happened in a live environment.

This may just be my misunderstanding of how the API works but if this is the case then I see merit in changing it. We already have an API to assign products to stores via V1/products/{sku}/websites, automatically doing it in a product update is confusing if I am not explicitly passing website ids to the product.

[magento-engcom-team]

@andrewkett, thank you for your report.
We've created internal ticket(s) MAGETWO-81413 to track progress on the issue.

[ankursachdeva11]

@andrewkett, Thanks for creating this issue. I am facing the same issue where we are able to assign website via API call and delete website link to the product via API call but we are unable to get all linked website to the product.

[TimurGafarovR]

I will work on that issue.

[adrian-martinez-interactiv4]

Hi @andrewkett , @ankursachdeva11 , @magento-engcom-team , I've been digging in this issue, and I'd like to expose some facts I've found, because it doesn't seem clear the behaviour of the REST API when creating a product.

If we have one endpoint to create the product, and another to link/unlink the products and websites, and the first one does not accept website ids as parameter (current API status), it makes sense that product/website links aren't automatically created, but created explicitly after creating the product calling the product website link repository.

The requested behaviour in this issue is easy to achieve, only requires to remove three lines in \Magento\Catalog\Model\ProductRepository::assignProductToWebsites method:

        if ($this->storeManager->getStore(true)->getCode() == \Magento\Store\Model\Store::ADMIN_CODE) {
            $websiteIds = array_keys($this->storeManager->getWebsites());
        }

Tested with Postman against All Store views (/rest/all/), it all works as expected in this ticket. I'd remove this, but that code might be there for a reason that I still don't know. Trying to find the motivation of this code, I find it was added here to main branch: a945f1f?diff=split#diff-ff4893a5628d34910295bae32fbcddfd

A more generic search reveals the motivation of that code: https://github.com/magento/magento2/search?q=MAGETWO-56512&type=Commits&utf8=%E2%9C%93 : Products created via REST API are not visible after enabling the product via scope = All Store Views

It seems that creating/updating a product status via POST/PUT request to V1/products/:sku didn't guarantee the product is visible, due to missing links between product and websites, so it gets linked by default with all existing websites when creating / updating the product, instead of create the needed product website links afterwards.

It has to be said that this only happens when you create / update a product against All Store views (/rest/all/) scope. Using /rest/default/ behaves different:

• When creating product (POST/PUT /rest/default/V1/products/:sku), product gets associated with default store website.

        unset($productData['media_gallery']);
        if ($createNew) {
            $product = $this->productFactory->create();
            if ($this->storeManager->hasSingleStore()) {
                $product->setWebsiteIds([$this->storeManager->getStore(true)->getWebsiteId()]);
            }
        } 

• When updating product (POST/PUT /rest/default/V1/products/:sku), product website links don't get modified.

Having this in account, my proposal is the next, trying to get maximum backwards compatibility, and achieve requested behaviour when updating product:

• Create product, scope = All Store Views (POST/PUT /rest/all/V1/products/:sku): Associate product with all websites, as it actually does.
• Update product, scope = All Store Views (POST/PUT /rest/all/V1/products/:sku): Preserve product website links; change actual behaviour for this.
• Create product, scope = Default Store (POST/PUT /rest/default/V1/products/:sku): Associate product with default store website, as it actually does.
• Update product, scope = Default Store (POST/PUT /rest/default/V1/products/:sku): Preserve product website links, as it actually does.;